@antoneeo/agentic-sdlc-skill 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Tutte le modifiche significative a questa skill saranno documentate in questo file.
 
+## [1.13.0] - 2026-07-05 (M2 amendment: review reads AND proves Vision + Use-Cases + Threat Model)
+### Changed
+- **Review discipline hardened (M2.A7).** `review.md` now, for an impact/solution-analysis / design review: (a) §Requesting takes the **Vision + use-cases/user-needs + threat model** as explicit inputs the reviewer checks the artifact *against* (Hybrid: M-VISION/D-UC/P-TM; Standalone: the ANALYSIS Vision-Alignment / Use-Cases / Threat-Model sections); (b) §Reviewing requires the reviewer OUTPUT to carry a **conformance/traceability statement** — each Vision benefit / use-case / threat mapped to where the artifact satisfies it, or a finding — and a PASS is **not valid on "found nothing"**. Scoped to analysis/design reviews (plain code reviews stay findings-only → honors the "no enforcement theater" Non-Goal); it is the reviewer-side twin of the existing §Receiving anti-silent-drop rule.
+- **`SKILL.md` §3 Request Analysis**: an authoring rule — build + trace the Impact/solution ON the Vision, use-cases and threat model (so the closure review can verify conformance); a pointer to `review.md`, no restatement.
+- **`templates.md`**: the ANALYSIS template gains a `## Use Cases / User Needs` section — the Standalone home for what Hybrid keeps in `D-UC`, giving the coverage-check a real target. Validator-inert (ANALYSIS_SECTIONS permits extra sections); the `Minimum sections` floor is deliberately left unchanged.
+
+### Process note
+Governed M2 amendment (Hybrid). E-ISP `e_isp_review_input_hardening` v2.0 (deep review, 3 rounds — round-1 BLOCK caught that the "use-case coverage" check had no Standalone home; v2.0 added the output-evidence half) + E-TDD v1.0 (light review, conformance statement 8/8) + §4.6 code review (PASS, zero BLOCK — self-caught + reverted a Minimum-sections regression before review). Doc-only: `check --hybrid` CLEAN, eval battery 51/51, shadow exported. The Hybrid mirror in the devPNT doctrine §4.5 + `devpnt-tech-reviewer` output format is a separate devPNT-project follow-up.
+
 ## [1.12.0] - 2026-07-03 (Client Roster: Google Antigravity 2.0 as a first-class client)
 ### Added
 - **Google Antigravity 2.0 support** in the install engine. The runtime skill now lands where all three Antigravity products (desktop, the `agy` CLI, the agentic IDE) discover global agent skills: `~/.gemini/config/skills/agentic-sdlc/`. `agentic-sdlc-init` writes the Antigravity project pointer to `AGENTS.md` (the Antigravity CLI surface), reusing the single `protocolContent` — no per-client drift.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-skill",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Documentation-First SDLC protocol with triage, Vision governance and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/agentic-sdlc-skill",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Documentation-First SDLC protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, installed support files and optional devPNT integration.",
   "keywords": [
     "claude-code",

package/skills/agentic-sdlc-skill/SKILL.md

@@ -183,6 +183,7 @@ Standalone L3:
 - Before creating a new `ANALYSIS_[feature].md`, search `ai_docs/solutions/` with glob/grep for an existing analysis on the same topic: if there is one, update it instead of duplicating it.
 - Create or update `ai_docs/solutions/ANALYSIS_[feature].md`.
 - Minimum sections: Objective, Feature Vision (or Vision Alignment), Impact, Security and Threat Model, Action Plan, Test Strategy, Diary/Current State.
+- Build the Impact/solution **on** the Vision, the use-cases/user-needs and the Security & Threat Model — read and trace to them first, and state the trace (which use-case / threat / benefit each part serves) so the closure review (`review.md`) can verify conformance. Do not draft the Impact in isolation.
 - For features spanning multiple milestones or multiple analyses, also create `ai_docs/vision/features/VISION_[feature].md`.
 
 Hybrid L3:

package/skills/agentic-sdlc-skill/review.md

@@ -14,6 +14,13 @@ When you hand work to a reviewer (human or agent), give them:
 - **The authoritative design artifact**: the ANALYSIS, E-TDD, or equivalent
   the change was built against — not a paraphrase of it.
 - **The actual diff**: the real changed files, not a description of them.
+- **For an impact/solution-analysis review, the constraints it derives from**:
+  the **Vision** (Hybrid: the `M-VISION`; Standalone: `project_vision.md`/`roadmap.md`
+  + the ANALYSIS Vision-Alignment), the **use-cases / user-needs** (Hybrid: `D-UC`;
+  Standalone: the ANALYSIS `## Use Cases / User Needs`), and the **threat model**
+  (Hybrid: `P-TM`; Standalone: the ANALYSIS `## Security and Threat Model`). Hand these
+  *in addition to* the design artifact — the reviewer checks the artifact **against**
+  them, not only for internal consistency.
 
 Never ask a reviewer to "review my session" or "review what I just did"
 without the artifacts above — that forces them to reconstruct scope from
@@ -45,6 +52,15 @@ When you are the reviewer:
   do not soften a real correctness or security issue to a nit.
 - No praise padding. A review reports problems and their fixes, not a
   summary of what looks fine.
+- **Conformance statement (impact/solution-analysis & design reviews only — not a
+  plain code-diff review).** When the artifact under review carries Vision / use-case
+  / threat-model constraints, your output MUST map each constraint to its evidence: for
+  every use-case/user-need, every threat, and every applicable Vision benefit/Non-Goal,
+  state WHERE the artifact satisfies it (section or `file:line`) or raise it as a
+  finding. A PASS/approve is **not valid on "found nothing"** — the conformance
+  statement is the proof the check ran; an unfalsifiable "I checked" is the review
+  theater this discipline exists to prevent (the reviewer-side twin of §Receiving's
+  silent-drop rule). Plain code reviews stay findings-only.
 
 ## Anti-patterns
 

package/skills/agentic-sdlc-skill/templates.md

@@ -154,6 +154,11 @@ end_date:
      VISION_[feature].md is created only if the feature spans multiple
      ANALYSIS documents or multiple milestones. -->
 
+## Use Cases / User Needs
+<!-- who needs this and why: the concrete use-cases / user-needs the change serves
+     (the Standalone home for what Hybrid keeps in D-UC). Derived from the elicitation
+     round; the Impact below must cover each, and the closure review checks coverage. -->
+
 ## Impact
 <!-- existing files touched, APIs/contracts, performance, new dependencies -->